{"id":"CVE-2023-26785","aliases":["BIT-mariadb-2023-26785","BIT-mariadb-min-2023-26785","BIT-mysql-client-2023-26785","EUVD-2023-30578","GHSA-jj42-9w8m-9979","UBUNTU-CVE-2023-26785"],"status":"disputed","title":"MariaDB v10.5 was discovered to contain a remote code execution (RCE) vulnerability.","description":"MariaDB v10.5 was discovered to contain a remote code execution (RCE) vulnerability via UDF Code in a Shared Object File, followed by a \"create function\" statement. NOTE: this is disputed by the MariaDB Foundation because no privilege boundary is crossed.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-12","score":0.02159,"percentile":0.82455,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-94"],"published":"2024-10-17T00:00:00Z","modified":"2026-10-28T02:30:53Z","affected":[{"source":"osv","ecosystem":"Bitnami","package":"mariadb","ranges":[{"type":"SEMVER","events":[{"introduced":"10.5.0"},{"last_affected":"10.5.0"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"mariadb-min","ranges":[{"type":"SEMVER","events":[{"introduced":"10.5.0"},{"last_affected":"10.5.0"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"mysql-client","ranges":[{"type":"SEMVER","events":[{"introduced":"10.5.0"},{"last_affected":"10.5.0"}]}]}],"products":[{"vendor":"mariadb","product":"mariadb"}],"references":[{"url":"https://github.com/Ant1sec-ops/CVE-2023-26785","tags":["Exploit","Third Party Advisory","advisory","package","report"]},{"url":"https://seclists.org/fulldisclosure/2012/Dec/39","tags":["Mailing List","discussion","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-26785","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-jj42-9w8m-9979"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/26xxx/CVE-2023-26785.json","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2023-26785","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-26785","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2023-26785","description":"MariaDB v10.5 was discovered to contain a remote code execution (RCE) vulnerability via UDF Code in a Shared Object File, followed by a \"create function\" statement. NOTE: this is disputed by the MariaDB Foundation because no privilege boundary is crossed.","status":"disputed","published":"2024-10-17T00:00:00Z","modified":"2024-10-20T23:39:53.553Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:35:15.434947Z"}],"euvd":[{"id":"EUVD-2023-30578","description":"MariaDB v10.5 was discovered to contain a remote code execution (RCE) vulnerability via UDF Code in a Shared Object File, followed by a \"create function\" statement. NOTE: this is disputed by the MariaDB Foundation because no privilege boundary is crossed.","status":"published","published":"2024-10-17T00:00:00Z","modified":"2024-10-20T23:39:53Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-03T00:27:32.691525Z"}],"ghsa":[{"id":"GHSA-jj42-9w8m-9979","title":"MariaDB v10.5 was discovered to contain a remote code execution (RCE) vulnerability.","description":"MariaDB v10.5 was discovered to contain a remote code execution (RCE) vulnerability.","status":"published","published":"2024-10-18T00:31:15Z","modified":"2024-10-21T00:31:56Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:58:33.183024Z"}],"nvd":[{"id":"CVE-2023-26785","description":"MariaDB v10.5 was discovered to contain a remote code execution (RCE) vulnerability via UDF Code in a Shared Object File, followed by a \"create function\" statement. NOTE: this is disputed by the MariaDB Foundation because no privilege boundary is crossed.","status":"disputed","published":"2024-10-17T22:15:02.743Z","modified":"2026-06-17T05:43:48.61Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:09:19.052418Z"}],"osv":[{"id":"CVE-2023-26785","description":"MariaDB v10.5 was discovered to contain a remote code execution (RCE) vulnerability via UDF Code in a Shared Object File, followed by a \"create function\" statement. NOTE: this is disputed by the MariaDB Foundation because no privilege boundary is crossed.","status":"published","published":"2024-10-17T00:00:00Z","modified":"2026-10-28T02:30:53.436228094Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:31.135751Z"},{"id":"UBUNTU-CVE-2023-26785","description":"MariaDB v10.5 was discovered to contain a remote code execution (RCE) vulnerability via UDF Code in a Shared Object File, followed by a \"create function\" statement. NOTE: this is disputed by the MariaDB Foundation because no privilege boundary is crossed.","status":"withdrawn","published":"2024-10-17T22:15:00Z","modified":"2026-04-02T19:19:01.86392Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T16:54:20.198616Z"},{"id":"BIT-mariadb-2023-26785","description":"MariaDB v10.5 was discovered to contain a remote code execution (RCE) vulnerability via UDF Code in a Shared Object File, followed by a \"create function\" statement. NOTE: this is disputed by the MariaDB Foundation because no privilege boundary is crossed.","status":"published","published":"2025-07-11T05:52:22.539Z","modified":"2026-09-08T08:48:24.05197575Z","updated_at":"2026-11-02T15:28:32.645004Z"},{"id":"BIT-mariadb-min-2023-26785","description":"MariaDB v10.5 was discovered to contain a remote code execution (RCE) vulnerability via UDF Code in a Shared Object File, followed by a \"create function\" statement. NOTE: this is disputed by the MariaDB Foundation because no privilege boundary is crossed.","status":"published","published":"2025-07-11T05:52:29.816Z","modified":"2026-09-08T08:48:12.515191333Z","updated_at":"2026-11-02T15:28:32.645004Z"},{"id":"BIT-mysql-client-2023-26785","description":"MariaDB v10.5 was discovered to contain a remote code execution (RCE) vulnerability via UDF Code in a Shared Object File, followed by a \"create function\" statement. NOTE: this is disputed by the MariaDB Foundation because no privilege boundary is crossed.","status":"published","published":"2025-07-11T05:56:57.141Z","modified":"2026-09-08T08:48:15.852282697Z","updated_at":"2026-11-02T15:28:33.469426Z"}]}}